change ssh port in linux - avoid sshd ddos attacks

change ssh port in linux in following steps, are you getting lot of bot flood traffic, high cpu usage due to default ssh port 22 in linux, then change the ssh port in linux and get sae server costs, and scale your linux server by simply changing the linux ssh port.

with default port 22

sshd Invalid user from port 33378

first allow New Port in linux firewall & cloud provide firewall

ex: my case added digitalocean firewall.

Table of Contents

Check well known ports choose from (1024 to 65535)

ssh brute force

sshd Invalid user from port

source port was 4627, the destination port was 2221

sshd blocked login by disconnecting the tcp connection

port number given in the log is the port on the client side, not on yours.

change SSHD port 21 to other

firewall rule block or drop

allow new port after successful login block old port 22.

choose any port between 1024 to 65535

add new SSH port to linux firewall allow list

sudo ufw allow 20482/tcp

sudo ufw allow ssh

sudo ufw app list

Available applications:

Apache

Apache Full

Apache Secure

OpenSSH

edit openssh in ubuntu debian linux distro

you can use nano or vim command.

nano /etc/ssh/sshd_config

CTRL+X to exit and save changes

Change default ssh port 22 to new port

#Port 22

Port 20682

default values are commented, if you uncomment new port it will override existing one.

#2 change ssh port in linux – restart sshd or ssh server – #

ssh for centos fedora redhat linux distributions.

sshd for ubuntu and debian both works fine.

service sshd reload

service sshd restart

systemctl restart ssh

Check SSH server listening newport or not

# netstat -tlpn| grep ssh

tcp 0 0 0.0.0.0:20682 0.0.0.0:* LISTEN 3529/sshd

tcp 0 0 0.0.0.0:1022 0.0.0.0:* LISTEN 1628/sshd

nano /etc/ufw/applications.d/ssh-server

remove port 22 from there.

22 port also listening

Login with New Port – change ssh port in linux

How do I unblock port 22?

ufw allow 22

Block Port 22 Using UFW Firewall – change ssh port in linux

sudo ufw deny 22

root@-s-4vcpu-8gb-blr1-01:~# sudo ufw deny 22
WARN: Skipping ‘openssh-server‘: couldn’t process

Block Port 22 using digitalocean firewall

go to networking >> firewall

Inbound Rules

Set the Firewall rules for incoming traffic. Only the specified ports will accept inbound connections. All other traffic will be blocked.

checkout digitalocean firewall

also know about digital ocean free credit

Check linux auth syslogs get rid of ddos attacks

tail -f /var/log/auth.log

Apr 24 06:26:44 -s-4vcpu-8gb-blr1-01 sudo: root : TTY=pts/0 ; PWD=/root ; US ER=root ; COMMAND=/usr/sbin/ufw deny 22

Failed password for invalid user dong from 170.245.200.100 port 54354 ssh2
Apr 18 06:27:44 -s-4vcpu-8gb-blr1-01 sshd[19631]: Received disconnect from 170.245.200.100 port 54354:11: Bye Bye [preauth]
Apr 18 06:27:44 -s-4vcpu-8gb-blr1-01 sshd[19631]: Disconnected from invalid user dong 170.245.200.100 port 54354 [preauth]
Apr 18 06:27:58 -s-4vcpu-8gb-blr1-01 sshd[19633]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=80.169.112.191 user=root
Apr 18 06:28:00 -s-4vcpu-8gb-blr1-01 sshd[19633]: Failed password for root from 80.169.112.191 port 33064 ssh2
Apr 18 06:28:01 -s-4vcpu-8gb-blr1-01 sshd[19633]: Received disconnect from 80.169.112.191 port 33064:11: Bye Bye [preauth]
Apr 18 06:28:01 -s-4vcpu-8gb-blr1-01 sshd[19633]: Disconnected from authenticating user root 80.169.112.191 port 33064 [preauth]

//disable root login, password login, pamuse=no.

Summary on changing ssh linux port

Hope, you get clear understanding of change of ssh port in linux, and the effects of changing linux ssh ports get rid bot traffic and strengthening linux server security you also want know about hardening linux security by tweaking sysctl. conf